CVE-2014-3085

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-08-17 · updated 2026-06-17
Weakness: CWE-78

Description

systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the lpres parameter.

Affected products

IBM Global Console Manager 16 Firmware: through 1.20.0.22575
IBM Global Console Manager 32 Firmware: through 1.20.0.22575

References

http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html
http://www.exploit-db.com/exploits/34132/
http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983
https://exchange.xforce.ibmcloud.com/vulnerabilities/94091
http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html
http://www.exploit-db.com/exploits/34132/
http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983
https://exchange.xforce.ibmcloud.com/vulnerabilities/94091

Get alerted when CVE-2014-3085 or the next vulnerability affects your stack